CVE-2025-24021

MEDIUM

iTop < 2.7.12 - Authenticated Missing Authorization

Title source: llm

Description

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/Combodo/iTop/security/advisories/GHSA-c8hm-h9gv-8jpj

Patch x_refsource_misc

https://github.com/Combodo/iTop/commit/44290db312901fc5918cc537c74561487fb3713b

View Patch ZIP pw:eip

Scores

CVSS v3 5.0

EPSS 0.0022

EPSS Percentile 13.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (1)

combodo/itop < 2.7.12

Published May 14, 2025

Tracked Since Feb 18, 2026